Re: [http-state] test data question

[Adam Barth <[e-mail]>]

On Tue, Nov 22, 2011 at 10:36 AM, Adam Barth <[e-mail]> wrote:
> Thanks for the report.  This is an error in the test suite, which I'll fix.

Done.

> The test is from an older version of the spec that allowed "valueless"
> cookies.  The working group decided to remove the concept of valueless
> cookies (we can look up the tracker number if you want to see exactly
> why).
>
> Thanks again,
> Adam
>
>
> On Tue, Nov 22, 2011 at 8:13 AM, Vasiliy Baranov
> <[e-mail]> wrote:
>> Hello,
>>
>> I have a cookie implementation that attempts to follow RFC 6265. If I run it
>> against the test data found in https://github.com/abarth/http-state, the
>> following test fails:
>>
>>    tests/data/parser/name0032-test:
>>
>>        Set-Cookie: "foo\"bar;baz"=qux
>>
>>
>>    tests/data/parser/name0032-expected:
>>
>>        Set-Cookie: "foo\"bar
>>
>>
>> I am by no means an expert in this area but it seems to me this test goes
>> against the spec, in particular, the following statement found in RFC 6265
>> on page 17:
>>
>>   2.  If the name-value-pair string lacks a %x3D ("=") character,
>>       ignore the set-cookie-string entirely.
>>
>>
>> My understanding is, for the test in question the name-value-pair is
>> '"foo\"bar'. This name-value-pair obviously lacks the "=" character, so my
>> reading of the spec is the cookie should be rejected entirely. The test,
>> however, expects the cookie to be accepted and sent back to the server on
>> the subsequent request. Does that mean my reading of the spec is incorrect?
>>
>> I tried this test in Chrome 16.0.912.41 beta-m, Firefox 6.0.1, IE 8, and
>> Safari 5.0.5. It passes everywhere except for Safari and my poor
>> implementation.
>>
>> Thanks,
>> -- Vasiliy
>> _______________________________________________
>> http-state mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/http-state
>>
>